CVE-2024-0428 is a high severity (CVSS 7.1) cross site request forgery flaw in the Index Now plugin for WordPress, in all versions up to and including 2.6.3. A forged request can delete arbitrary site options. Update the plugin to 2.6.4 or later.
What's affected
The Index Now plugin for WordPress, all versions up to and including 2.6.3, per the record. The record links a WordPress plugin changeset on the 2.6.4 tag that changes the settings view file, which points to 2.6.4 as the release with the fix. The Wordfence entry linked by the record did not load for us, so confirm the fixed version in the plugin directory changelog.
The cause is missing or incorrect nonce validation on the reset_form function. A nonce is a one time token WordPress uses to check that a request came from a real admin screen. The weakness is CWE-352, cross site request forgery.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. It needs no privileges but does need user interaction, since an administrator must be tricked into an action such as clicking a link. Impact is low on integrity and high on availability. It is not on the CISA Known Exploited Vulnerabilities list, and we found no report of exploitation.
How to check if you're exposed
On any site you manage, open the plugin list in the dashboard and read the version of Index Now. With WP-CLI, run:
wp plugin get mihdan-index-now --field=version
The slug comes from the plugin repository path in the changeset link. If the command says the plugin is not installed, the slug on your site may differ, so use wp plugin list and look for Index Now.
Anything at 2.6.3 or older is in range. Check staging copies and sites you maintain for clients as well.
What to do now
- List the sites that run the Index Now plugin.
- Update the plugin to 2.6.4 or later through the dashboard or WP-CLI.
- If you cannot update, deactivate the plugin until you can.
- Ask administrators not to browse other sites or click untrusted links while signed in to the dashboard.
- Review site settings after the update. Deleted options can show up as missing configuration or odd behaviour, and a backup lets you restore them.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can scan dependency manifests, and the Gold directory tracks WordPress plugin entries like this one.
Why it matters
This is a request forgery bug, so the attacker never logs in. The attacker prepares a link or page, and an administrator who is signed in carries out the request without knowing. Deleting site options can break a site or reset its configuration, which fits the high availability impact in the vector.
Nonce checks are the standard defence, and a missing one on a single function is enough. Plugin authors can avoid the whole class by verifying a nonce and a capability before any state changing handler runs. Site owners get little warning from the plugin screen, so tracking versions matters.
Quick check
Does CVE-2024-0428 need a logged in attacker?
No. The attacker does not need an account, but an administrator has to be tricked into performing an action such as clicking a link.
Which version fixes CVE-2024-0428?
The changeset linked from the record is on the 2.6.4 tag, so 2.6.4 or later. Confirm in the plugin changelog.
Sources
Last reviewed: 19 October 2026.
